{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:a2bb461c-d734-5ae3-84ed-33fb4b549835", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.apache.logging.log4j/log4j-core-test@2.22.1-tuxcare.3", "type": "library", "group": "org.apache.logging.log4j", "name": "log4j-core-test", "version": "2.22.1-tuxcare.3", "purl": "pkg:maven/org.apache.logging.log4j/log4j-core-test@2.22.1-tuxcare.3" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:7868ee34-13d5-5d0b-9975-383993fc33bf", "id": "CVE-2014-8180", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2014-8180 is a false positive for org.apache.logging.log4j:log4j-core-test 2.22.1-tuxcare.3." }, "affects": [ { "ref": "pkg:maven/org.apache.logging.log4j/log4j-core-test@2.22.1-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:35ecf4f0-4b87-5850-ab03-5a6d0b8053a2", "id": "CVE-2016-6494", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2016-6494 is a false positive for org.apache.logging.log4j:log4j-core-test 2.22.1-tuxcare.3." }, "affects": [ { "ref": "pkg:maven/org.apache.logging.log4j/log4j-core-test@2.22.1-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:a339e26a-52db-5b23-baf8-721b0cb668b7", "id": "CVE-2021-32036", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2021-32036 is a false positive for org.apache.logging.log4j:log4j-core-test 2.22.1-tuxcare.3." }, "affects": [ { "ref": "pkg:maven/org.apache.logging.log4j/log4j-core-test@2.22.1-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:a3d29d40-dd8e-548c-b68c-3b2da81db76f", "id": "CVE-2021-38295", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2021-38295 is a false positive for org.apache.logging.log4j:log4j-core-test 2.22.1-tuxcare.3." }, "affects": [ { "ref": "pkg:maven/org.apache.logging.log4j/log4j-core-test@2.22.1-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:ef6ef095-1df8-52cd-b751-b06314965d53", "id": "CVE-2022-24706", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2022-24706 is a false positive for org.apache.logging.log4j:log4j-core-test 2.22.1-tuxcare.3." }, "affects": [ { "ref": "pkg:maven/org.apache.logging.log4j/log4j-core-test@2.22.1-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:4b510987-3099-5235-9a2e-48c4e215759a", "id": "CVE-2023-26268", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2023-26268 is a false positive for org.apache.logging.log4j:log4j-core-test 2.22.1-tuxcare.3." }, "affects": [ { "ref": "pkg:maven/org.apache.logging.log4j/log4j-core-test@2.22.1-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:3fffd8b1-00a0-50cd-aeb7-bb973fc60d47", "id": "CVE-2023-45725", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2023-45725 is a false positive for org.apache.logging.log4j:log4j-core-test 2.22.1-tuxcare.3." }, "affects": [ { "ref": "pkg:maven/org.apache.logging.log4j/log4j-core-test@2.22.1-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:8bad9971-baec-59a3-9405-8c286f544268", "id": "CVE-2025-68161", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-68161 is fixed in version 2.22.1-tuxcare.3 of org.apache.logging.log4j:log4j-core-test." }, "affects": [ { "ref": "pkg:maven/org.apache.logging.log4j/log4j-core-test@2.22.1-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:c2e50b3d-e5f3-5e5a-a8c1-e109bac6b978", "id": "CVE-2026-34477", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-34477 affects version 2.22.1-tuxcare.3 of org.apache.logging.log4j:log4j-core-test." }, "affects": [ { "ref": "pkg:maven/org.apache.logging.log4j/log4j-core-test@2.22.1-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:8799c309-7bdb-5136-902e-ce5338d24ec0", "id": "CVE-2026-34478", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-34478 does not affect version 2.22.1-tuxcare.3 of org.apache.logging.log4j:log4j-core-test. Version not vulnerable (per prereq analysis); terminalized." }, "affects": [ { "ref": "pkg:maven/org.apache.logging.log4j/log4j-core-test@2.22.1-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:a9005a4c-2302-532b-b0e9-5aa71acaf207", "id": "CVE-2026-34479", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34479 is fixed in version 2.22.1-tuxcare.3 of org.apache.logging.log4j:log4j-core-test." }, "affects": [ { "ref": "pkg:maven/org.apache.logging.log4j/log4j-core-test@2.22.1-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:e08b0a49-5ac6-5905-a542-c0cf351b9eea", "id": "CVE-2026-34480", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-34480 does not affect version 2.22.1-tuxcare.3 of org.apache.logging.log4j:log4j-core-test. Version 2.22.1 is not vulnerable. Summary: The target repository version 2.22.1-tuxcare.1 is NOT VULNERABLE to CVE-2026-34480. While the XmlLayout feature exists, the sanitization fix that addresses the vulnerability has been backported and is fully implemented in the current codebase. [terminalized not_affected from patch_application_manual/not_vulnerable]" }, "affects": [ { "ref": "pkg:maven/org.apache.logging.log4j/log4j-core-test@2.22.1-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:f72a2b7c-84d9-5519-993b-42996db52f79", "id": "CVE-2026-34481", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34481 is fixed in version 2.22.1-tuxcare.3 of org.apache.logging.log4j:log4j-core-test." }, "affects": [ { "ref": "pkg:maven/org.apache.logging.log4j/log4j-core-test@2.22.1-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:f4959204-cee9-50bf-9fd8-68d2e36ab58e", "id": "CVE-2026-49844", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-49844 is fixed in version 2.22.1-tuxcare.3 of org.apache.logging.log4j:log4j-core-test." }, "affects": [ { "ref": "pkg:maven/org.apache.logging.log4j/log4j-core-test@2.22.1-tuxcare.3" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.apache.logging.log4j/log4j-core-test@2.22.1-tuxcare.3" } ] }